CVE-2026-2868

The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress (versions up to 3.5.3) is vulnerable to Stored Cross-Site Scripting via the 'separatorIconSVG' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-leve...

CVE-2026-2868 Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'separatorIconSVG'

The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'separatorIconSVG' parameter in versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-39103

Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of service via the src/scenegraph/svgattributes.c, svgparsestrings, gfsvgparseattribute...

CVE-2026-39103

Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of service via the src/scenegraph/svgattributes.c, svgparsestrings, gfsvgparseattribute...

PT-2026-36950

The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'separatorIconSVG' parameter in versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-37277

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.0-beta.2 Description A low-privileged user with page creation permissions can perform stored Cross-Site Scripting XSS by injecting an svg element. This occurs because the XSS filter in the detectXss function uses a...

GPAC 安全漏洞

GPAC is an open-source multimedia framework developed by GPAC. There is a security vulnerability in GPAC, which stems from a buffer overflow in the gfsvgparseattribute function found in the src/scenegraph/svgattributes.c file. This vulnerability could lead to a denial-of-service attack...

PT-2026-41401

Dear Grav Security Team, A security vulnerability was discovered in Grav CMS that allows authenticated attackers to read arbitrary files from the server through XML External Entity XXE injection. Vulnerability Summary | Field | Details | |-------|---------| | Vulnerability Type | XML External...

PT-2026-37061

Name of the Vulnerable Software and Affected Versions GPAC versions prior to commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 Description A buffer overflow allows an attacker to cause a denial of service. This issue occurs within the src/scenegraph/svg attributes.c file, specifically involving th...

CVE-2026-39103

The GPAC multimedia framework is affected by a buffer overflow vulnerability in versions prior to commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 . The issue resides within the src/scenegraph/svg_attributes.c file, specifically affecting the svg_parse_strings() and gf_svg_parse_attribute() funct...

CVE-2026-39103

Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of service via the src/scenegraph/svgattributes.c, svgparsestrings, gfsvgparseattribute...

Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-6861)

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-6861 advisory. - A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs...

EUVD-2026-27071

Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST /api/files/upload, any unauthenticated user can upload an SVG file with XSS. The method POST /v1/files/upload, which requires authentication through the application API, is also vulnerable. This...

CVE-2026-42138 Dify Vulnerable to Stored XSS via SVG-file upload

Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST /api/files/upload, any unauthenticated user can upload an SVG file with XSS. The method POST /v1/files/upload, which requires authentication through the application API, is also vulnerable. This...

CVE-2026-42138

CVE-2026-42138 affects Dify (open-source LLM app development platform). Before v1.13.1, an SVG upload via POST /api/files/upload allowed unauthenticated XSS, and POST /v1/files/upload was also vulnerable when authenticated. The issue is patched in v1.13.1. Impact is stored XSS; remediation is upg...

CVE-2026-42138 Dify Vulnerable to Stored XSS via SVG-file upload

Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST /api/files/upload, any unauthenticated user can upload an SVG file with XSS. The method POST /v1/files/upload, which requires authentication through the application API, is also vulnerable. This...

CVE-2026-42138

Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST /api/files/upload, any unauthenticated user can upload an SVG file with XSS. The method POST /v1/files/upload, which requires authentication through the application API, is also vulnerable. This...

svgo: SVGO: Denial of Service via XML entity expansion

A flaw was found in SVGO, an SVG Scalable Vector Graphics Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service DoS by submitting a specially crafted XML file. The application's failure to properly guard against XML entity expansion or recursion can lead to the Node....

PT-2026-36885

Name of the Vulnerable Software and Affected Versions Dify versions prior to 1.13.1 Description An issue exists in this open-source LLM app development platform where users can upload SVG files containing Cross-Site Scripting XSS, which is a technique that allows attackers to execute malicious...

dify 跨站脚本漏洞

Dify is an open-source LLM application development platform developed by LangGenius. Versions of Dify prior to 1.13.1 had a cross-site scripting vulnerability. This vulnerability stemmed from the POST /api/files/upload method, which allowed unauthenticated users to upload SVG files containing...